EU Law and Practice Contributed by: Charlotte Gerrish and Evane Alexandre, Gerrish Legal
Where a new controller is introduced, transparency obligations under Articles 13 and 14, GDPR may apply. In share deals, although the legal entity remains unchanged, changes in processing practices or gov - ernance structures may trigger updated transparency or internal compliance measures. Cross-border transactions must comply with the inter - national transfer regime under Chapter V GDPR. Following closing, integration requires alignment of privacy notices, retention schedules and technical and organisational measures. Data must be securely transferred, retained or deleted in accordance with the agreed transaction structure and GDPR principles. 5. International Considerations 5.1 Restrictions on International Data Transfers Cross-border transfers of personal data from the EU are governed by Chapter 5 of the GDPR. A “transfer” occurs where personal data is disclosed or made accessible to a controller or processor in a third country (that is to say, outside of the EU) or to an international organisation. This includes remote access from outside the EU. Personal data may be transferred to a third country only if Chapter 5 conditions are met. The primary route is an adequacy decision under Article 45, GDPR. Where the European Commission has determined that a third country ensures an essentially equivalent level of protection, personal data may flow to that coun - try without additional transfer authorisation. In the absence of adequacy, transfers must rely on appro - priate safeguards under Article 46, GDPR, most com - monly standard contractual clauses or binding corpo - rate rules. Exporters are required to assess whether the legal framework of the recipient country allows the safeguards to be effective in practice. Derogations under Article 49, GDPR are available only for specific and occasional situations and cannot be used for systematic or large-scale transfers.
Regarding non-personal data, EU law does not impose a comparable transfer regime. However, the Data Act introduces safeguards aimed at preventing unlawful third-country governmental access to data held by EU data processing service providers. 5.2 Government Notifications and Approvals Under the GDPR, international transfers of personal data do not generally require prior registration, notifi - cation or approval by a supervisory authority, provided that a recognised transfer mechanism under Chapter 5 is used. Sector-specific frameworks (eg, in financial services, telecommunications or export-controlled industries) may impose separate notification or approval require - ments under national or EU law. 5.3 Data Localisation Requirements EU law promotes the free movement of data within the Union. The Free Flow Regulation prohibits member states from imposing unjustified localisation require - ments for non-personal data. For personal data, the GDPR does not impose localisation requirements but restricts transfers to third countries unless Chapter V conditions are met. Remote access from a third coun - try is typically considered a transfer and must comply with GDPR transfer mechanisms. Sector-specific rules may impose localisation or resi - dency requirements in limited contexts (eg, certain public sector like health or financial data), but these are exceptions rather than the rule at EU level. 5.4 Blocking Statutes EU law contains rules that may restrict compliance with certain foreign disclosure or discovery orders. Under Article 48, GDPR, judgments or administrative decisions from third-country authorities requiring the transfer or disclosure of personal data are enforceable in the EU only if based on an international agreement, such as a mutual legal assistance treaty (MLAT). In other words, foreign court orders cannot, by them - selves, justify a transfer of personal data from the EU. Where a foreign authority requests access to personal data, the disclosure must still comply with the applica -
101 CHAMBERS.COM
Powered by FlippingBook